Do Son BRONZE SANDCASTLE uses Sandboxie DLL sideloading to run a modified Meterpreter backdoor in memory against targets in Asia and Africa.
China APT
China-nexus WARP PANDA APT targets VMware/Azure with BRICKSTORM, a Golang backdoor using DoH for stealth. The group creates "ghost VMs" and conducts session replay attacks for long-term espionage.
CISA/NSA exposed BRICKSTORM, a Chinese state-sponsored backdoor targeting VMware vCenter/ESXi and ADFS servers. The self-restarting malware used DoH and nested TLS for 18 months of persistent espionage.
CyberArmor exposed Autumn Dragon, a China-nexus APT using a WinRAR path traversal flaw (CVE-2025-8088) and DLL sideloading to deploy a Telegram C2 backdoor for espionage in Southeast Asia.
Google exposed APT24's stealth BADAUDIO C++ downloader. The three-year campaign includes a supply chain hack hitting 1,000+ domains, using control flow flattening and AES-encrypted cookies for C2.
A China-linked APT targeted a U.S. policy nonprofit for weeks in April 2025. The group used DLL sideloading via a VipreAV binary and msbuild.exe scheduled tasks to achieve SYSTEM persistence for espionage.
Trend exposed "Premier Pass-as-a-Service," a model where Earth Estries (access broker) and Earth Naga (APT36) share compromised network access to deploy ShadowPad in a coordinated espionage campaign.
Symantec exposed Warlock ransomware (a probable Anylock rebrand) used by China-linked Storm-2603. It exploits the SharePoint zero-day and BYOVD to disable security and encrypt files with the .x2anylock extension.
Elastic exposed Chinese threat actors exploiting public ASP.NET machine keys to deploy TOLLBOOTH IIS backdoor and HIDDENDRIVER kernel rootkit. The malware performs stealthy SEO cloaking.
Seqrite exposed Operation Silk Lure, a campaign using a malicious Chinese resume (.LNK) to implant ValleyRAT on FinTech systems. It achieves persistence via a “Security” scheduled task and uninstalls AV.
Symantec exposed China's Jewelbug APT in an unprecedented 5-month intrusion on a Russian IT provider. The group used Yandex Cloud for data exfiltration and Graph API for stealthy C2 via custom malware.
Volexity found China-aligned APT UTA0388 used ChatGPT to generate multilingual spear-phishing lures and assist in GOVERSHELL malware development for espionage.
Salt Typhoon, a China-MSS linked APT, targets global telecoms and military networks for long-term espionage, exploiting network edge devices for future cyber warfare ops.
ShadowSyndicate’s Global Ransomware Empire Blurs Lines Between Cybercrime and Geopolitical Espionage
ShadowSyndicate’s Global Ransomware Empire Blurs Lines Between Cybercrime and Geopolitical Espionage
A new report exposes ShadowSyndicate, a sophisticated cybercrime group tied to top-tier RaaS affiliates, bulletproof hosting, and suspected geopolitical influence operations, blurring lines between cybercrime and espionage.